iOS 17 Adds Link Tracking Protection

What Changed

Some websites and ad platforms add identifiers to links, known as link decoration, so they can recognize a user after they click through to another site. Ad click IDs added to landing page URLs are a common example.

With iOS 17 in September 2023, Apple introduced Link Tracking Protection. It removes known tracking information from links that people share in Messages and Mail, and from links opened in Safari Private Browsing.¹ The links still work; only the tracking parameters are removed.

In Safari Private Browsing, WebKit says the protection covers the parts of a URL most often used for tracking: query parameters and the fragment.² Safari removes a subset of query parameters it has identified as used for pervasive cross-site tracking granular to users or clicks, and leaves the rest of the URL intact. Normal Safari browsing is not affected by default, though users can turn on advanced tracking protection for all browsing in settings.

Why It Mattered

As cookies and device identifiers became harder to use, click IDs in URLs became one of the main ways ad platforms connected an ad click to a later conversion. Link Tracking Protection targeted that workaround directly. Firefox had taken a similar step in 2022, stripping known tracking parameters in its strict mode.

Apple doesn't publish the list of parameters it removes. Industry analysis has generally reported that ad click IDs are stripped, while campaign-level UTM parameters, which describe a campaign rather than an individual click, are kept.³ That distinction matters: it limits user-level attribution while leaving campaign reporting in analytics tools mostly intact.

The list appears to be growing, though Apple hasn't confirmed it. In July 2026, two companies that sell server-side tracking tools said their reviews of WebKit's open-source code showed Safari 27 adding parameters used by Threads (xmt), YouTube (si) and X (twclid, cn and cxt) to the Google and Meta click IDs already covered. Both found the stripping still applies mainly to Private Browsing, Mail and Messages.^4,5 Apple's Safari 27 release notes don't mention the change.⁴

Google had already changed its own click IDs on iPhone. Since iOS 14.5, Google Ads adds gbraid and wbraid parameters to clicks from iOS devices in place of the usual gclid, which it says helps it comply with Apple's policies while measuring results with conversion modelling.⁶

The direct reach was limited to links in Messages and Mail and to Private Browsing. But it showed that Apple was willing to go after link decoration, and iOS 26 later extended fingerprinting protection to all Safari browsing.